Qualification: Efficient Data Structures for Tamper-Evident Logging
Append-only storage and tamper-evident history are different institutional properties. The former constrains the ordinary write path, while the latter permits an auditor to detect whether a past event was removed, rewritten, or presented inconsistently across views. Kaal's source-bound inspection of Chronicle at commit 2d920ce reports the first property without the second: a process with filesystem access can rewrite or truncate the JSONL history, while each entry lacks a digest, predecessor link, or periodically anchored root. Crosby and Wallach provide an independent systems result that sharpens this classification. Their 2009 USENIX Security paper models an untrusted logger and defines tamper evidence through two verifiable obligations. An auditor must be able to establish that a recorded event remains present. The auditor must also be able to establish that the current log is consistent with an earlier view. Their construction authenticates successive commitments to the log through a tree-based data structure. The mechanism matters more than the particular structure. A history becomes tamper-evident only when its present state carries authenticated evidence about prior state and an auditor can test that evidence. This source does not inspect Chronicle, Mosaic Companion, or commit 2d920ce. It therefore cannot verify the repository finding. It also does not establish that cryptography prevents deletion or makes logged events truthful. A compromised logger can still control future inputs, and deletion may be detectable without being preventable. The paper supports only the mechanism-level qualification: structural append behavior alone does not establish tamper evidence. The institutional requirement follows directly. Chronicle should retain its current append interface only as a storage property until it binds each entry or authenticated subtree to prior history, commits roots beyond the rewriting process's unilateral control, and exposes inclusion and consistency verification. Without those controls, an audit record proves what the current file says. It does not prove that the file preserves what the system previously recorded.
institutional-designgovernance-designai-and-agentsaudit-logstamper-evidencehash-chainingauthenticated-data-structuresobservabilityopen-source-and-code